Magazine menu Close Magazine menu

Campaigns

Latest stories

project vesta

This start-up is turning the tide on climate change

  • min read
    • As part of Kaspersky's Bring on the Future series, we meet businesses around the world who are changing their industry and society for the better. The seaside. For some, a place of rest, relaxation, and perhaps a hint of volleyball. But, to Eric Matzner, CEO of Project Vesta, beaches, and more importantly, olivine rocks, could hold the solution to our climate change battle. I spoke to Eric about Project Vesta's mission, the Paris Agreement, and how a little-known rock could pull trillions of tons of carbon from our atmosphere. Ryan Loftus: So what's the story behind Project Vesta, Eric? Eric Matzner: Project Vesta was born out of my climate angst, to be honest. It started when I was looking through various climate agreements, like the Paris Agreement. The secret, hidden in plain sight, is that even with these proposals and the suggested cuts, to keep global warming below 1.5C by the end of the century, we need to remove between 100m to a trillion tons of CO2. Large-scale carbon removal is imperative. I started thinking about different technologies that could do the job, but nearly all of the suggested techniques have challenges, such as limitations on ­scale, requiring a lot of energy or competing for land use. Then I came across a paper called Rolling Stones, which focused on a scalable way detailing how olivine rock can capture CO2 economically to mitigate global warming, while also combating ocean acidification. The basic idea was that olivine rock, placed on shell beaches, could help remove total human carbon emissions. Other research shows that olivine rock weathering could scale up easily, wasn't too energy-intensive and didn't compete for arable land. I searched far and wide to find the current status of the technique to see if there was a pilot project, emailing scientists and asking people in the industry but found that no one was doing it. So after researching it, I decided that if this were to become a reality, I would need to create the project. So, I started Project Vesta, formed a team, and launched on Earth Day 2019. It's ambitious! What's the big vision? At its peak, I hope Project Vesta can galvanize the world into removing large quantities of CO2, by providing irreversible, permanent storage of CO2 at an economically viable price, that doesn't compete for farmland or other resources. Exactly what the world needs right now. How does the process work? There are reserves of a rock called olivine, all over the world, for which there is almost no demand. Project Vesta wants to mine these rocks from quarries on the surface and then place them on high-energy beaches in tropical areas. This is part of Earth's natural carbonate-silicate cycle: rain mixes with CO2 to create carbonic acid, which falls on rocks, weathering them down and transporting water (filled with ions) into rivers, which eventually ends up in the ocean. Over time, usually millions of years, the carbonic acid becomes bicarbonate and then calcium carbonate, which corals and other marine animals use to build shells. When they die and fall to the seafloor, the shells turn into sediments and then form limestone, trapping CO2 for millions of years. By adding olivine directly to the ocean, we dramatically speed up the carbon removal process, by cutting out these steps in the middle. The bicarbonate molecule is alkaline, as opposed to the acidic CO2 dissolved in water, so we can help create this molecule, which raises the PH of the ocean, helping to de-acidify it. In turn, other parts of the rock are inert or not available to organisms, and are not predicted to have any adverse effects. The reason we use beaches is to make the process efficient; otherwise, we would use too much energy to grind the rocks down to very fine particles. This is how it works: reserves of olivine near coastal areas are located and then harvested; the rock is then lightly crushed to pebble-sized grains and placed onto beaches where the wave motion tumbles them and grinds them down. The process also removes a coating on the surface that would typically slow the reaction. That's some process. How will you do that? Right now, we're looking for states and cities with access and legal ownership over beaches to help provide a testbed for our pilot safety study. We need two bays nearby each other, one as control and one in which to put olivine rocks. Then we'll measure the results. Once we have our pilot project, we'll write a research paper summarising all of the existing literature on coastal weathering, including our results and findings, to demonstrate the viability of our process and take it to policymakers. What are the benefits of fighting climate change this way? This is a method of carbon removal that Earth uses to put 99.9 percent of its carbon into rock. We know the process works and can scale to the trillion-ton level that we need to have a chance to stop catastrophic global warming. By using undeveloped coastlines with otherwise unwanted resources, we can scale this project to global levels without disrupting food systems or other limited resources in a world with a growing population. This is a solution that's permanent, scalable and can be done with today's technology. We could reach an operational price of below ten dollars for each tonne of CO2 removed. And there are co-benefits too. Olivine is made up, in part, by magnesium and silica. The latter, when released through weathering, becomes shells for diatoms – microalgae found in oceans, comprising a hugely important part of the food chain – which is threatened by ocean acidification. Our project might be worthwhile just for the acidification effects. A recent study reported that Dungeness Crab's shells are dissolving much sooner than predicted due to pockets of ocean acidity, so that lends extra importance to our work. Another benefit of this method – if the world gets hotter and the oceans more acidic, our weathering process will speed up, making it future proof.  Two-pronged benefits then. How do you differ from other companies doing the same? I don't know of anyone else doing this, beyond the scientists we're working with across the world. But if there is, we'd love to collaborate. We're a non-profit on a mission to solve humanity's biggest challenge, and we're always looking for partners and friends in the industry. In terms of the security of your project, how do you keep your customer and technology data secure? For our donors, we use a tokenization system through Stripe, where we do not even possess credit card information. We don't have a vast amount of proprietary data, but we limit access strictly to the key decision-makers. We're an open-source non-profit, so as we generate scientific data, we'll publish that openly. Good practice. What significant challenges have you faced so far? Trying to bring together scientists who have been working on different elements of this concept for years, then uniting them across different time-zones, dialects, regions and fields! On the flip side, what big successes have you had? Well, to date, we've raised over $100,000 for our pilot project. We've had great feedback about how elegant our solution is. We're giving people hope because they see this could be a significant part of the solution to climate change. And we have key scientists in the field on board working on a paper about olivine weathering. Well said. What does the future hold for Project Vesta? We need to raise $1.5M to deploy our two pilot projects and monitor them for two years. So, we're fundraising, crowdfunding and selling our line of olivine jewelry to raise money. Right now, the money is helping fund our operations and spread awareness. Once we have two beaches for our pilot project, the funds raised from the jewelry will correlate to an amount of olivine we will place on a beach. Eventually, we'll make peridot gemstone rings – olivine is also known as peridot, the august birthstone, in its crystal form – which we hope will replace the role of diamonds in our society. We aspire to shift society's value from the past compression of carbon (which is how a diamond is formed) to the future removal of carbon (which is how the "profit" from the ring will be used). We hope the jewelry will connect people to their carbon removal, giving them something tangible and symbolic, as opposed to just a donation. Right now, we're selling a necklace called the Grain of Hope, which is a single grain of olivine suspended in a sand timer vial, a metaphor to demonstrate that olivine has the potential to stop time from running out on us to combat this most pressing of human issues. Soon you'll be able to subscribe to Project Vesta for $25 a year, which will place one ton of olivine rock onto a beach for you – almost removing your yearly CO2 emissions per year. Project Vesta wants to prove the viability of olivine weathering for CO2 removal. In turn, de-risking the process and making it an easy choice for policymakers, who can then, we hope, action it to help save our planet.
telecommuting cybersecurity

Cybersecurity for home working in a hurry

  • min read
    • Rushing to make decisions that have security consequences is never ideal. Equally, there are times when we get thrown a curve ball and must act quickly. If home-working is new for your company, and you need to get policies and systems in place fast, you'll want to know the cybersecurity risks and how to reduce them. Start here to make sure your staff are securely set up to work from home as soon as possible. Home internet connections can be vulnerable When your employees work in the office on the local network, your security solutions handle data exchange processes. But when employees work from home, there's an extra variable – internet service providers (ISPs). You can't control their ISP's security, which may mean their home connection is vulnerable to attack. The solution: A reliable virtual private network (VPN) For your employees to connect remotely to corporate resources, set them up with a reliable virtual private network (VPN). This makes a secure channel between their workstation and your infrastructure. You'll also need to disallow connections to corporate resources from external networks without a VPN. Behavior changes make attacks harder to spot When people work from home, their routines change. Telecommuters can't just walk over to a colleague to talk about something. Expect an increase in correspondence, including new participants – people with whom communication used to be purely verbal. These changes give attackers more opportunity, in particular for Business Email Compromise (BEC) attacks – for example, using an account with an address similar to the victim's. In other words, a fake message asking for data will not seem as unusual as it normally might. The more relaxing home environment can make many people less vigilant. The solution: Using protected work email only, and staff knowing why First, employees at home should use only work email. This makes it easier to spot a cybercriminal's attempt to impersonate a colleague from an account on another domain. Second, protect your mail servers with technologies that can detect attempts to change the message sender, like our solutions for both mail servers and Microsoft Office 365. Third, before employees start working from home, make sure they get a crash course in cyberthreats. Use of leaky collaboration tools can rise Without face-to-face contact, employees may start using other ways to collaborate. Some might not be the most reliable – and must be set up correctly. For example, a Google Docs document with certain access permission configurations may be indexed by a search engine, leaking corporate data. The same thing can happen to data in cloud storage. A collaboration environment like Slack can also leak, and a randomly added outsider could get access to the whole history of files and messages. The solution: Choose a better collaboration environment Choose a collaboration environment with suitable security and features. Participants should need a corporate email address to register. It's often worthwhile appointing a dedicated administrator to issue and revoke rights as needed. Most important, before employees work from home, hold an awareness session – which could be remote. Insist they use only the approved collaboration system, and reiterate their responsibility for keeping corporate secrets safe. Risks of home computer use Generally speaking, not all employees have access to corporate laptops. And mobile phones are not suitable for all tasks. Employees might start using their home computers. This can pose a serious threat for companies with no Bring Your Own Device (BYOD) policy. The solution: Protected corporate equipment or BYOD policy If possible, give home-working employees appropriately protected corporate laptops and phones. These should be protected with solutions that allow remote wiping of corporate information, keep personal and corporate data separate, and restrict the ability to install applications. Make sure the devices also automatically check for the latest critical software and operating system (OS) updates. If employees must use their own devices, introduce a BYOD policy for managing corporate data on those devices, for example, partitions for business and personal data. Insist employees install home antivirus software. Allow devices to connect to corporate networks only after confirming they have a security solution installed and an up-to-date OS. Others accessing employees' equipment It's one thing for employees to work at home alone during the day, but another if they go to a café or coworking space, where risks of leakage or compromise are far greater. The solution: access policies and awareness Security policies should require a password and automatic screen lock. And as with other cybersecurity issues in telecommuting, awareness training is a must to maintain overall vigilance. This article was published in March, 2020.
working from home research girl laptop coffee sofa

Working from home: The research is in

  • min read
    • Remote working, telecommuting, working from home. Whatever you call it, since the pandemic more workplaces are offering or even expecting employees to work from home at least some of the time. Is home working just a trend, or is there evidence to support whether it works? I decided to find out what the research had to say. Here are eight crucial findings. 1. Remote work is common Gartner's 2021 survey of 10,000 digital workers found remote workers represent 32 percent of the workforce worldwide. 64 percent said they were more likely to consider a role that allowed flexible hours over one that didn't. What's the opportunity? Offering flexible working is now the norm. If your business isn't there yet, you may have to have some tough conversations to get things moving. Today's the day to start. 2. Homeworking could give you an extra day per week A Stanford study that monitored around 500 employees in China's largest travel agency for two years found working from home increased productivity by over 20 percent. That's equivalent to an extra working day each week. The increase in productivity came from several ways employees changed how they were working. They took fewer breaks and less time off (such as sick days), but mostly, they just got through more work. Professor of Economics, Nicholas Bloom, explained these findings in his TedX Stanford talk. What's the opportunity? If you want to improve productivity, make sure home working is on the table. If you're already doing it but it's not delivering, your policy may need review, so the next point is salient. 3. It's not for everyone The same Stanford study found that after the trial work-from-home period, around half the participants decided to be office-based in the future. What's the opportunity? Everyone's an individual, and your business homeworking policy should reflect this. Flexible or home working also means taking into account each employee's role, needs and preferences. Reconsider an 'all or nothing' approach to home working. 4. Remote workers struggle to 'switch off' Two large studies during the pandemic found home-workers were working longer hours than they had in the office. They reported taking shorter breaks, working through sickness and not logging off until as late as 8pm. 55 percent wanted their employer to communicate and expect work only within the usual hours. What's the opportunity? Switching off and unwinding makes us better at our work. We should see it as part of our job. More so if we work from home, because the research suggests it's harder to do. Review your organization's health and well-being policy. If it doesn't place value on employees taking breaks and switching off, it should. No matter your seniority, you can cultivate a culture that values unwinding and doesn't expect your employees to be 'always on' just because they're at home, particularly if you're working with team members across multiple time zones. 5. The value of homeworking may depend on the type of work A 2021 study of over 700 academics working from home during the pandemic found nearly half reported being less efficient while working from home, but 70 percent thought they'd be more efficient if they could decide in the future when to work from home. The academics seemed to think the ideal scenario is choosing when to work from home and when not to, depending on what work they had to do. They thought home working made them less good at sharing with colleagues, keeping in touch with the team and collecting data, but better at writing papers, reading the literature and analyzing data. What's the opportunity? Hybrid working – combining remote and in-office work – is a great option, especially for those teams whose work varies between requiring focus and requiring collaboration. Let your staff choose as much as possible when to work where, but make sure there are opportunities for sharing with colleagues. 6. Cybercriminals have noticed more people are working from home Researchers noted the first wave of coronavirus-themed attacks used the situation to spread scams, by way of phishing, ransomware and malware. But it's not just individuals who are vulnerable. Whole organizations can get distracted. Banking on a lack of IT resources and vulnerabilities like legacy software, targets have included educational institutions and government agencies that have been in the news for conducting learning and business remotely. What's the opportunity? Kaspersky's white paper Remote working: How to make the laptop lifestyle flow sweetly (and securely) for your business is a good place to start for security measures that enable remote working. In the event of a cybersecurity incident, prioritize good communication. The World Health Organization's (WHO) response to coronavirus email scammers pretending to be them is an excellent example of a promptly issued statement in plain language that raises awareness of cybercrime. 7. Young talent values working from home, but needs much face-to-face time too Ipsos Mori and Nationwide 2021 research found Gen Z and Millennials were more likely than any other group to want to work from home three or more days a week. On the other hand, half believed working from home was straining their health and wellbeing and similar numbers said they needed face-to-face time with colleagues to be effective at work. What's the opportunity? If you're having trouble attracting early talent like graduates and apprentices, it's another reason to look at your flexible-working offer. Ipsos Mori's Dr Linda Papadopoulos suggests, "championing a flexible working approach on where and when staff work, by helping them to find a work pattern which balances their work and life." 8. Offering remote working helps attract and retain more diverse talent Being more supportive of remote and flexible working will help companies attract and retain more women, in part because women are far more likely than men to shoulder care responsibilities. As this Felstead and Henseke research shows, working from home helps employees adapt to personal circumstances. But what about other groups under-represented in your workplace? Seekout describes remote working as "the single best secret of diversity recruitment." They cite the desire to work remotely as at the top of the list for many job-seekers, attracting more applicants overall, and homeworking has apparent attractions for women and disabled people. Where's the opportunity? You can only gain more top talent by making sure your job adverts highlight flexible working as a benefit. It's in the top two employee benefits applicants care most about. Attracting more applicants is, of course, just the first step in building a more diverse workforce. Minimizing unconscious bias helps make sure the best applicants get hired. Every company's needs are unique; many industries need the presence of people to make and deliver goods and services, serve customers or devise ideas together. But consider if your non-frontline staff could benefit from having the option to work at least some of the time remotely. These findings can support you in finding the best way to harness the power of remote working and guide you around common pitfalls. The one that gives me the most pause for thought (pun intended) is the importance of switching off and taking a break. No matter who you are – from apprentice to chief executive – your most important work might not just happen in your home office. It might be when you're doing nothing at all.
transform home working

How to stay sane and secure while working from home

  • min read
    • We live in an interconnected world of freedom and possibility. When it works, it's bliss. With the right (secure) technology, we can work anywhere. Video conferencing, live chat, social media and good old-fashioned email let us catch up with a home-based teammate or share reports with a partner in the opposite time zone. In times of crisis, mobile working is a necessity. When Italy and parts of China shut down to help limit the spread of COVID-19 (the coronavirus), many employers around the world also shut office doors and asked their people to log on from home. They didn't want to take the risk, and they were ready. If health and travel restrictions hit your area, you can keep calm and carry on if your company already has a secure virtual private network (VPN) access to the corporate network and an advanced approach to flexible working. When metropolitan life shifts off track I've lived and worked in London for two decades. As a recent graduate, like so many others who move to large cities, I was lured by the dream of streets paved with gold. And our world keeps getting more urban. UN research suggests by 2050, more than two in three people worldwide will live in a city. Any Londoner will tell you a transport workers' strike is as much part of London life as the chime of Big Ben. We never know until the final hour whether it will happen or what fresh chaos will ensue, like squeezing onto one of the city's iconic red buses after a two-hour wait, with a desperate hollar of, "Can someone please open a window?" In the technologically distant past (well, 2014), I worked in a trendy publishing house. In the center of my sleek glass desk was a state-of-the-art, large-screen desktop Mac. On the occasion of one memorable strike, this was little help. For two days, I donned sneakers and walked 10 miles to the office and back. I revelled in this new change of pace, discovering new streets and unexpected architecture, seeing my city in a new light. But for most who work in London, walking and cycling is not practical. Four million people commute for more than two hours a day. Home vs. office: Productivity is still a challenge Nowadays, working in an international team with Kaspersky, I choose the best times to go to the office, when face-to-face counts, and when the connection with peers and the business dynamic helps me most. But when public transport grinds to a halt, a pandemic hits or I just feel a bit lackluster, I know I can work just as well from home quarters as from headquarters. But how do you work from home and stay sane and productive? There's plenty of advice out there on how to work effectively at home. Having a dedicated workspace, working regular office hours and locking the cat in a separate room are all good strategies. Less often touched upon, is security. Here are some tips. https://youtu.be/J96DETNCZCw Discipline goes hand-in-hand with lack of discipline My homeworking strategy is, discipline meets mind-wandering. Discipline to time block, catch deadlines, get things done. The reward: a long lunch and Netflix episode, a brisk walk or trip to the store, a match or 10 of Angry Birds, then picking up the slack later. My home office routine is more like this freelancer's experience – certainly, I can fashion an impromptu meal in under eight minutes from the contents of a fridge-freezer. TV chefs rarely extol the virtues of tinned soup as a base ingredient for lunch, but take it from me, it's endlessly versatile. For variety, I'll work anywhere in the house, other than the bathroom. I sometimes miss the office water cooler chat, but there are alternatives. During my first foray into home working in 2010, I discovered Twitter, made many professional contacts (and friends) from it, and never looked back. For those working in teams, the popularity of project tools like Slack and Microsoft Teams means inspiration (or distraction) is just a click away. The rise and benefits of mobile and flexible working Mobile working is more than a trend. Stanford University found remote workers were 13 percent more productive than desk-based counterparts. And flexible working, when you have more choice about whether to work from the office or elsewhere, is on the rise, along with its productivity benefits. Work Foundation estimates 70 percent of organizations will have adopted mobile working by 2020. When HSBC surveyed its employees recently, it found 89 percent through flexible working was key to getting more work done. And the Global Shapers Survey, supported by the World Economic Forum, found nearly one in three under 30s chose work-life balance as critical criteria when considering a role. Yet many office-based businesses still can't, or don't, offer much choice for home working. During the height of the coronavirus crisis, a Global Web Index survey of UK and US people found only 10 percent were encouraged to work from home. It shouldn't be either/or. Offering flexible and mobile working means on-premises employees are more likely to give more back. How so? Imagine your sales star, Angela. She's just flown back from a conference in the US. She's been on the go for 72 hours, charming potential customers at the delegate party, trying to set up product demo calls and writing proposals on the 10-hour flight home. By the time her (delayed) flight lands, she's physically and mentally shattered. Imagine how she feels about having to get up with the lark, navigating rush hour traffic to slump onto her desk? How well will Angela perform today? Now instead, imagine Angela sleeps late and wakes recharged. She switches on her laptop and is ready to start selling. Flexible, mobile and teleworking are no longer anomalies, they're business as usual. Not doing it may mean when factors beyond your control affect your business, you're on the back foot – far behind competitors whose non-frontline and office employees are already working from where they are. Embedding a more flexible-friendly culture also means presenteeism, and clocking in and out, are no longer viewed as success. Mobile workers need better cybersecurity If you're a business owner or IT leader, you're probably wondering what the proliferation of remote and flexible working means for cybersecurity. From malware and ransomware to decentralizing control of your IT networks, you'll need to do some things to protect your business. You'll also need to introduce the right equipment, training and policies – including bring-your-own-device – to make sure telecommuters are working securely. Here are more recommendations for teleworking and security. Reading Kaspersky's Remote working: How to make the laptop lifestyle flow sweetly (and securely) for your business will also help keep your people happy and your business safe.
immersive labs interview

Game-changing ways to improve employee cyber-awareness

  • min read
    • Games, badges, colorful illustrations. Probably not the words you'd associate with cyber-skills training. But, for Immersive Labs, this is the future. I talked to Chris Pace, Technology Advocate, about why traditional cybersecurity lectures don't work, the importance of engaging employees about cyber-skills, and a game-changing new development – Bandersnatch for data breaches. Ryan Loftus: Who started Immersive Labs, and how did they come to found it? Chris Pace: Our founder, James Hadley, was working as a cyber-skills instructor at the Government Communications Headquarters (GCHQ). After running PowerPoint-heavy cybersecurity courses in dark rooms, he could see first hand how ineffective this way of training is. The more PowerPoint he did, the less engaged people were. This was where the idea for the company was born, from his frustration that traditional classroom cyber-skills training methods don't work. No more death by PowerPoint! What's the big vision? At first, we felt we could deliver a platform that could be used by learning and development professionals to deliver engaging cyber-skills training. But the way we've evolved the platform has moved things on. Now, our vision has expanded from providing employees with training to allowing companies and businesses to track and measure their cyber-capabilities. What skills do they have? What skills do they need? For many companies, that's a huge thing, especially for large financial enterprises. Helping employees and their businesses – nice. How does the platform work? Immersive Labs offer bite-sized cybersecurity challenges – otherwise known as "labs" – that people can complete using a cloud-based platform, anytime and wherever they want. Essentially, these labs are a collection of individual games that place the user within real-life cybersecurity scenarios. The labs ask you for one answer to a question, but you have to do three out of four tasks to get that answer. There are badges, points, illustrations – it's designed to engage, as opposed to teach. And they cover a wide range of topics; we have over 600 labs and counting. One of my favorites is the penetration testing lab – you basically hack a power station. You understand the industrial control system, find weaknesses in the software then work out how to exploit it. We've set up a webcam showing a simulation film for when the user finishes. When you hack the power station, the webcam turns on and you see the power station shutting down. It's a bit of fun, but it's a cool outcome that immerses people in the environment. That example is quite specific to cyber professionals, but we offer hundreds of different labs for varying levels of expertise. They range from how to spot a phishing email to how to code securely; there's something for every level of cyber-knowledge. When we start working with a new client, we help them tailor objectives that shape what labs we advise. For example, one goal might be 'develop employees into roles where they are cybersecurity proficient,' then we recommend a series of labs for them to complete. It's an entirely different way of looking at the cyber-awareness issue. What are the benefits of training employees in this way? Traditional classroom environments aren't for everyone. And when it comes to cyber-skills training, or more importantly, your business security, you need to engage people to understand how to stay cyber secure. By gamifying and framing training differently, you can teach lessons that stick. Our technology plays into a current trend: mobile gaming. It's the on-demand element, users can access our platform from their computer, tablet or mobile device wherever they are, whenever they want. That's a huge benefit. Our data shows that over 50 percent of people taking the courses are doing it outside of work and on weekends as they want to be top of the company leader board on a Monday morning. But the benefits go beyond engaging employees. From the business's perspective, knowing the types of skills you have, or more importantly, don't have, is invaluable. Using our technology can help identify where to plug those skills gaps. It also encourages businesses to grow that talent internally from the resources they already have. Right now, it's clear we need to get to a place where we're not sourcing cyber-professionals, we're developing them. Platforms like ours can help businesses do that. Sourcing people is expensive; growing talent saves time and money in the long run. There's a considerable need for home-grown cyber professionals, for sure. How do Immersive Labs differ from similar technologies on the market? I think what sets us apart is our depth – we have over 600 labs and counting. We pride ourselves on adding new content directly related to the threat landscape. When something new comes along – whether that's a new malware or cybercrime group – we deliver a lab to educate businesses on the threat. So when a new threat hits the news that's relevant to our customers and the broader security community, we immediately create something to help them understand it. Roughly, we add four labs a week. Then if something is in the news, we add a lab on the same day. Wow, that's quick! What challenges have you faced so far? One of our biggest challenges was finding a way to show clients the value our product can add. Persuading people can be tricky, especially if they're used to classroom lectures and online courses. Other than that, classic growing pains. Notably going from a small team in a shipping container to a 100-person office. The change in culture can be a challenge, but we've done a great job of adapting. On the flip side, what's been your biggest success? Being made the de-facto cyber-skills provider for the NHS (UK's National Health Service) – that was a major success for us. As a relatively new company, any new customer is a success. It shows that people see the value of our product. Now, as we've grown, we don't need to try and show businesses the value Immersive Labs can add, they understand straight away. That's a nice position to be in. What does the future hold? Right now, we're working on a cyber-crisis simulator. It does what it says on the tin: puts people into a real-time cyber crisis. It's carnage! There's literally a breach happening right now, what are you going to do? What decisions are you going to make? And ultimately, how will those decisions impact your reputation or share price. You can do it in teams, or individually, and you get immediate feedback. There are tons of visualizations, data and metrics showing performance, which good decisions you made and why, and where there is room for improvement. Has your CEO been seen sweating on live TV? Have you had a media alert to say your share price has fallen through the floor? There are so many ways it can go, that's what makes it interesting. It's like Bandersnatch for breaches (an episode from the recent Netflix series Black Mirror using interactive choose-your-own-adventure paths)  – and our customers' need for it has driven this product. They've told us they want it. Thanks Chris – best of luck in the future!
security bytes privacy reputation

How to build customer trust when a data breach happens

  • min read
    • Although common in all kinds of organizations and businesses, data breaches still make striking headlines. We all work hard to prevent them, but how should you communicate about data breaches when they happen? In the Security Bytes series, senior InfoSec professionals give their most savvy advice. This time, I asked several cybersecurity experts with incident response experience: Some chose to speak under a pseudonym, but all share sound advice that could help save your company's reputation when, despite your robust work to protect it, a cybercriminal succeeds in accessing your information. Hire the best PR firm Principal Security Consultant L0ra thinks a well-coordinated, experienced PR firm can best handle your company's reputation. She also believes the public responds well when companies admit their mistakes. "The biggest mistake companies make is glossing over their failures, but breaches happen every day. It isn't the first time. It won't be the last. "If the breach is large and public, immediately hire the best PR firm you can afford. "Sometimes, in response to a data breach, you get a raid. That's when a group of people comes at you on the internet. The number one rule for dealing with a raid is, log off and keep quiet. So you need a good PR firm to speak on your behalf." Communicate through the right people, and learn from mistakes Ray Hayes is Senior Software Engineer, Enterprise and Security at Microsoft. He highlights the importance of knowing who you're speaking with and learning from mistakes. "I don't speak about any incident off-the-cuff. I refer all inquiries to my leadership team. "If I'm asked informally about a major data breach or any other incident at my company, I make conversation, but keep it general, and make sure I know who I'm talking to. "Breach response is critical, but prevention is key. "Anyone starting a new job should think, "What could happen if the information I'm working on now was released?'" Involve everyone in planning – before it happens Security engineer Daniel says responding to data breaches must involve more than just the technical people. You need legal experts and business communicators too. "All companies should prepare for data breaches, especially those with data worth stealing. Small- and medium-sized businesses (SMBs) more often don't recognize the threat. "Before it happens, get everyone involved in making a crisis plan, not just IT. It's not only a technical problem. Involve legal, finance, safety and everyone else. They have valuable insight tech people often don't, and will have their own tasks to do when it happens." Tell customers affected, quickly and honestly James O, Director of Information Security, says informing your customers truthfully is a must. "Our insurance company gives us a Breach Coach to help our PR firm get the messages right. We also coordinate with internal communications to inform the families we serve, and start telling affected people as quickly as possible. We also report under our state data breach laws. "Companies could improve their data breach PR. When my data was accessed in a financial company's breach, I just got a form letter saying, here's your year of identity protection. "At least they included the root cause – leaving generic credentials on a public box – but that doesn't give me confidence that it won't happen again." Avoid the 'sophisticated attack' cliché Security Analyst http_error_418 says PR is vital, but companies must stop exaggerating cyberattackers' skills. "Companies often handle breaches with platitudes. They'll say the attacker was 'advanced' and 'sophisticated.' That's because, when it's later shown their app wasn't patched for eight years, investors are over the initial fright. "We also need to consider when transparency helps, and when it's overkill. "The public often don't fully understand what transparency reveals." Update regularly and learn from the best Cyber Threat Intel Analyst HackerPom points to an example of good practice. "When they know the facts, executives, PR and legal should give the media and customers regular updates. For a good example, look at Norsk Hydro's response to a bad data breach. Their communications were clear and straightforward." Better to overstate than understate the impact Joonatan Kauppi, Founder and CEO of Leijona Security, has several pieces of good advice. "If you're unsure of the impact, it's better to overstate than understate. If you downplay it, then word breaks that it's much more serious, you'll get worse press. "Bring the regulatory authorities into the loop straight away. "Inside the organization, start damage control, and don't skimp on costs. Gather the facts and inform your communicators. "Answer questions from security researchers and other InfoSec people. They ask the right stuff and are a good platform to communicate what happened. "Prepare for the flurry of questions you'll get from people or parties affected. Don't blame. Concentrate on reducing the impact of the breach." Make sure your plan fits all scenarios David Emm, Principal Security Researcher at Kaspersky, says to make sure you're planning for the full range of data that might be breached. "Balance technical and PR in responding to a breach. You can only do this well if you have a process for managing security incidents. Involve the right people across the organization – including IT, HR, legal and PR – and work out a plan before anything happens. The light of experience There are strong themes from these experts when it comes to how to communicate around data breaches. I'm hearing almost everyone say, plan for how you'll respond before it happens, involving people across the organization. Several say, to use the best PR available, and communicate with speed, honesty and regularity. By sharing the right information at the right time, in the right way, you'll get the right outcome: customers understanding how they're affected, and appreciating what you've learned. Article reflects the opinions of the author and speakers quoted. Published in 2019.
by Innovating leaders.
Innovative tech.
About Secure Futures

Secure Futures magazine is your go-to business guide for opinions, trends and insight into the world of technology and cybersecurity. We help your business to bring on the future. Brought to you by Kaspersky, the global cybersecurity experts.

  • For all other countries